| enterprise |
T1071 |
Application Layer Protocol |
- |
| enterprise |
T1071.001 |
Web Protocols |
During Frankenstein, the threat actors used HTTP GET requests for C2. |
| enterprise |
T1119 |
Automated Collection |
During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information. |
| enterprise |
T1020 |
Automated Exfiltration |
During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary’s C2. |
| enterprise |
T1059 |
Command and Scripting Interpreter |
- |
| enterprise |
T1059.001 |
PowerShell |
During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts. |
| enterprise |
T1059.003 |
Windows Command Shell |
During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named “WinUpdate”, as well as other encoded commands from the command-line |
| enterprise |
T1059.005 |
Visual Basic |
During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script. |
| enterprise |
T1005 |
Data from Local System |
During Frankenstein, the threat actors used Empire to gather various local system information. |
| enterprise |
T1140 |
Deobfuscate/Decode Files or Information |
During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload. |
| enterprise |
T1573 |
Encrypted Channel |
- |
| enterprise |
T1573.001 |
Symmetric Cryptography |
During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC. |
| enterprise |
T1041 |
Exfiltration Over C2 Channel |
During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary’s C2. |
| enterprise |
T1203 |
Exploitation for Client Execution |
During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim’s machine. |
| enterprise |
T1105 |
Ingress Tool Transfer |
During Frankenstein, the threat actors downloaded files and tools onto a victim machine. |
| enterprise |
T1036 |
Masquerading |
- |
| enterprise |
T1036.004 |
Masquerade Task or Service |
During Frankenstein, the threat actors named a malicious scheduled task “WinUpdate” for persistence. |
| enterprise |
T1027 |
Obfuscated Files or Information |
- |
| enterprise |
T1027.010 |
Command Obfuscation |
During Frankenstein, the threat actors ran encoded commands from the command line. |
| enterprise |
T1588 |
Obtain Capabilities |
- |
| enterprise |
T1588.002 |
Tool |
For Frankenstein, the threat actors obtained and used Empire. |
| enterprise |
T1566 |
Phishing |
- |
| enterprise |
T1566.001 |
Spearphishing Attachment |
During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents. |
| enterprise |
T1057 |
Process Discovery |
During Frankenstein, the threat actors used Empire to obtain a list of all running processes. |
| enterprise |
T1053 |
Scheduled Task/Job |
- |
| enterprise |
T1053.005 |
Scheduled Task |
During Frankenstein, the threat actors established persistence through a scheduled task using the command: /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR, named “WinUpdate” |
| enterprise |
T1518 |
Software Discovery |
- |
| enterprise |
T1518.001 |
Security Software Discovery |
During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system. |
| enterprise |
T1082 |
System Information Discovery |
During Frankenstein, the threat actors used Empire to obtain the compromised machine’s name. |
| enterprise |
T1016 |
System Network Configuration Discovery |
During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system. |
| enterprise |
T1033 |
System Owner/User Discovery |
During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information. |
| enterprise |
T1221 |
Template Injection |
During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website. |
| enterprise |
T1127 |
Trusted Developer Utilities Proxy Execution |
- |
| enterprise |
T1127.001 |
MSBuild |
During Frankenstein, the threat actors used MSbuild to execute an actor-created file. |
| enterprise |
T1204 |
User Execution |
- |
| enterprise |
T1204.002 |
Malicious File |
During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email. |
| enterprise |
T1497 |
Virtualization/Sandbox Evasion |
- |
| enterprise |
T1497.001 |
System Checks |
During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution. |
| enterprise |
T1047 |
Windows Management Instrumentation |
During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version. |